# CVEs published 2022-01-25

102 CVEs were published on January 25, 2022: 2 critical, 13 high. Days are UTC.

- [CVE-2021-36348](https://cve.now/CVE-2021-36348.md): iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. (CVSS 5.9, Integrated Dell Remote Access Controller)
- [CVE-2021-36347](https://cve.now/CVE-2021-36347.md): iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. (CVSS 6.2, Integrated Dell Remote Access Controller)
- [CVE-2021-36346](https://cve.now/CVE-2021-36346.md): Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. (CVSS 5.3, Integrated Dell Remote Access Controller)
- [CVE-2021-36296](https://cve.now/CVE-2021-36296.md): Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. (CVSS 7.2, Dell VNX Control Station)
- [CVE-2021-36295](https://cve.now/CVE-2021-36295.md): Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. (CVSS 7.2, Dell VNX Control Station)
- [CVE-2021-36294](https://cve.now/CVE-2021-36294.md): Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. (CVSS 9.8, Dell VNX Control Station)
- [CVE-2021-36289](https://cve.now/CVE-2021-36289.md): Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. (CVSS 7.8, Dell VNX Control Station)
- [CVE-2022-23258](https://cve.now/CVE-2022-23258.md): Microsoft Edge for Android Spoofing Vulnerability (CVSS 4.3, Microsoft Edge for Android)
- [CVE-2021-43799](https://cve.now/CVE-2021-43799.md): RabbitMQ exposes ports with weak default secrets in Zulip Server (CVSS 8.6, zulip)
- [CVE-2021-41598](https://cve.now/CVE-2021-41598.md): UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user (no CVSS, GitHub Enterprise Server)
- [CVE-2022-23029](https://cve.now/CVE-2022-23029.md): On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a (no CVSS, BIG-IP)
- [CVE-2022-23028](https://cve.now/CVE-2022-23028.md): On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cook (no CVSS, BIG-IP AFM)
- [CVE-2022-23030](https://cve.now/CVE-2022-23030.md): On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (no CVSS, BIG-IP)
- [CVE-2022-23032](https://cve.now/CVE-2022-23032.md): In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP (no CVSS, BIG-IP Edge Client for Mac and Windows)
- [CVE-2022-23031](https://cve.now/CVE-2022-23031.md): On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (no CVSS, BIG-IP FPS, ASM, and Advanced WAF)
- [CVE-2022-23027](https://cve.now/CVE-2022-23027.md): On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 (no CVSS, BIG-IP)
- [CVE-2022-23019](https://cve.now/CVE-2022-23019.md): On BIG-IP version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a messag (no CVSS, BIG-IP)
- [CVE-2022-23021](https://cve.now/CVE-2022-23021.md): On BIG-IP version 16.1.x before 16.1.2, when any of the following configurations are configured on a virtual server, undisclosed requests ca (no CVSS, BIG-IP)
- [CVE-2022-23020](https://cve.now/CVE-2022-23020.md): On BIG-IP version 16.1.x before 16.1.2, when the 'Respond on Error' setting is enabled on the Request Logging profile and configured on a vi (no CVSS, BIG-IP)
- [CVE-2022-23025](https://cve.now/CVE-2022-23025.md): On BIG-IP version 16.1.x before 16.1.1, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, when a SIP ALG profile is (no CVSS, BIG-IP)
- [CVE-2022-23023](https://cve.now/CVE-2022-23023.md): On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ al (no CVSS, BIG-IP & BIG-IQ)
- [CVE-2022-23024](https://cve.now/CVE-2022-23024.md): On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.2, and all versions of 13.1.x, when the IPsec applica (no CVSS, BIG-IP AFM)
- [CVE-2022-23022](https://cve.now/CVE-2022-23022.md): On BIG-IP version 16.1.x before 16.1.2, when an HTTP profile is configured on a virtual server, undisclosed requests can cause the Traffic M (no CVSS, BIG-IP)
- [CVE-2022-23026](https://cve.now/CVE-2022-23026.md): On BIG-IP ASM & Advanced WAF version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12 (no CVSS, BIG-IP ASM & Advanced WAF)
- [CVE-2022-23017](https://cve.now/CVE-2022-23017.md): On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when a virtual server is c (no CVSS, BIG-IP)
- [CVE-2022-23018](https://cve.now/CVE-2022-23018.md): On BIG-IP AFM version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and 13.1.x beginning in 13.1.3.4, when a virtual (no CVSS, BIG-IP AFM)
- [CVE-2022-23013](https://cve.now/CVE-2022-23013.md): On BIG-IP DNS & GTM version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x (no CVSS, BIG-IP DNS & GTM)
- [CVE-2022-23012](https://cve.now/CVE-2022-23012.md): On BIG-IP versions 15.1.x before 15.1.4.1 and 14.1.x before 14.1.4.5, when the HTTP/2 profile is configured on a virtual server, undisclosed (no CVSS, BIG-IP)
- [CVE-2022-23015](https://cve.now/CVE-2022-23015.md): On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, and 14.1.2.6-14.1.4.4, when a Client SSL profile is configured on a virtual s (no CVSS, BIG-IP)
- [CVE-2022-23016](https://cve.now/CVE-2022-23016.md): On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP SSL Forward Proxy with TLS 1.3 is configured on a virtual server, u (no CVSS, BIG-IP)
- [CVE-2022-23014](https://cve.now/CVE-2022-23014.md): On versions 16.1.x before 16.1.2 and 15.1.x before 15.1.4.1, when BIG-IP APM portal access is configured on a virtual server, undisclosed re (no CVSS, BIG-IP APM)
- [CVE-2022-23011](https://cve.now/CVE-2022-23011.md): On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while pr (no CVSS, BIG-IP)
- [CVE-2022-23008](https://cve.now/CVE-2022-23008.md): On NGINX Controller API Management versions 3.18.0-3.19.0, an authenticated attacker with access to the "user" or "admin" role can use undis (no CVSS, NGINX Controller API Management)
- [CVE-2022-23010](https://cve.now/CVE-2022-23010.md): On BIG-IP versions 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, when (no CVSS, BIG-IP)
- [CVE-2022-23009](https://cve.now/CVE-2022-23009.md): On BIG-IQ Centralized Management 8.x before 8.1.0, an authenticated administrative role user on a BIG-IQ managed BIG-IP device can access ot (no CVSS, BIG-IQ Centralized Management)
- [CVE-2021-43298](https://cve.now/CVE-2021-43298.md): The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting (no CVSS, embedthis goahead)
- [CVE-2021-45729](https://cve.now/CVE-2021-45729.md): WordPress WP Google Map plugin \<= 1.8.0 - Privilege Escalation vulnerability (CVSS 5.4, WP Google Map)
- [CVE-2021-40337](https://cve.now/CVE-2021-40337.md): OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product (CVSS 4.2, Hitachi Energy LinkOne)
- [CVE-2021-4145](https://cve.now/CVE-2021-4145.md): A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. (no CVSS, QEMU)
- [CVE-2021-4133](https://cve.now/CVE-2021-4133.md): A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new (no CVSS, Keycloak · org.keycloak:keycloak-services)
- [CVE-2022-0335](https://cve.now/CVE-2022-0335.md): A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-0333](https://cve.now/CVE-2022-0333.md): A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-0334](https://cve.now/CVE-2022-0334.md): A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-0332](https://cve.now/CVE-2022-0332.md): A flaw was found in Moodle in versions 3.11 to 3.11.4. (no CVSS, moodle · moodle/moodle)
- [CVE-2022-0270](https://cve.now/CVE-2022-0270.md): Improper header sanitization in bored-agent causes escalation of privilege (CVSS 8.8, Mirantis bored-agent)
- [CVE-2022-22789](https://cve.now/CVE-2022-22789.md): Charactell - FormStorm Enterprise Account Take Over (CVSS 6.1, Charactell FormStorm Enterprise)
- [CVE-2021-38129](https://cve.now/CVE-2021-38129.md): Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to and including 12.21. (no CVSS, Micro Focus Operations Agent.)
- [CVE-2021-40167](https://cve.now/CVE-2021-40167.md): A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by rea (no CVSS, Autodesk® Design Review)
- [CVE-2021-39031](https://cve.now/CVE-2021-39031.md): IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injectio (CVSS 7.5, IBM WebSphere Application Server Liberty)
- [CVE-2021-46087](https://cve.now/CVE-2021-46087.md): In jfinal\_cms \>= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. (no CVSS)
- [CVE-2021-46085](https://cve.now/CVE-2021-46085.md): OneBlog \<= 2.2.8 is vulnerable to Insecure Permissions. (no CVSS)
- [CVE-2021-46083](https://cve.now/CVE-2021-46083.md): uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code. (no CVSS)
- [CVE-2021-46084](https://cve.now/CVE-2021-46084.md): uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box. (no CVSS)
- [CVE-2021-46086](https://cve.now/CVE-2021-46086.md): xzs-mysql \>= t3.4.0 is vulnerable to Insecure Permissions. (no CVSS)
- [CVE-2021-34870](https://cve.now/CVE-2021-34870.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52\_ (CVSS 6.5, NETGEAR XR1000)
- [CVE-2021-34869](https://cve.now/CVE-2021-34869.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. (CVSS 7.8, Parallels Desktop)
- [CVE-2021-34868](https://cve.now/CVE-2021-34868.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. (CVSS 7.8, Parallels Desktop)
- [CVE-2021-34867](https://cve.now/CVE-2021-34867.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. (CVSS 7.5, Parallels Desktop)
- [CVE-2021-34866](https://cve.now/CVE-2021-34866.md): This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. (CVSS 8.8, Linux Kernel · :linux\_kernel:)
- [CVE-2021-34865](https://cve.now/CVE-2021-34865.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. (CVSS 8.8, NETGEAR Multiple Routers)
- [CVE-2021-43863](https://cve.now/CVE-2021-43863.md): SQL Injection in FileContentProvider (GHSL-2021-1007) (CVSS 7.5, nextcloud android)
- [CVE-2021-46034](https://cve.now/CVE-2021-46034.md): A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box. (no CVSS)
- [CVE-2021-46033](https://cve.now/CVE-2021-46033.md): In ForestBlog, as of 2021-12-28, File upload can bypass verification. (no CVSS)
- [CVE-2021-3850](https://cve.now/CVE-2021-3850.md): Authentication Bypass by Primary Weakness in adodb/adodb (CVSS 9.1, adodb/adodb · adodb/adodb-php)
- [CVE-2021-46089](https://cve.now/CVE-2021-46089.md): In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. (no CVSS, org.jeecgframework.boot:jeecg-boot-base · org.jeecgframewor…)
- [CVE-2022-21697](https://cve.now/CVE-2022-21697.md): SSRF vulnerability (requires authentication) (CVSS 6.3, jupyterhub jupyter-server-proxy · jupyter-server-proxy)
- [CVE-2022-23035](https://cve.now/CVE-2022-23035.md): Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involve (no CVSS, xen)
- [CVE-2022-23034](https://cve.now/CVE-2022-23034.md): A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where (no CVSS, xen)
- [CVE-2022-23033](https://cve.now/CVE-2022-23033.md): arm: guest\_physmap\_remove\_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm ( (no CVSS, xen)
- [CVE-2021-45847](https://cve.now/CVE-2021-45847.md): Several missing input validations in the 3MF parser component of Slic3r libslic3r 1.3.0 can each allow an attacker to cause an application c (no CVSS)
- [CVE-2021-45846](https://cve.now/CVE-2021-45846.md): A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker to cause an application crash using a crafted AMF document, where a me (no CVSS)
- [CVE-2022-23945](https://cve.now/CVE-2022-23945.md): Apache ShenYu missing authentication allows gateway registration (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sheny…)
- [CVE-2022-23944](https://cve.now/CVE-2022-23944.md): Apache ShenYu 2.4.1 Improper access control (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sheny…)
- [CVE-2022-23223](https://cve.now/CVE-2022-23223.md): Apache ShenYu Password leakage (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sheny…)
- [CVE-2021-45029](https://cve.now/CVE-2021-45029.md): Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection (no CVSS, Apache Software Foundation Apache ShenYu · org.apache.sheny…)
- [CVE-2021-46113](https://cve.now/CVE-2021-46113.md): In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files (no CVSS)
- [CVE-2021-45803](https://cve.now/CVE-2021-45803.md): MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2021-45802](https://cve.now/CVE-2021-45802.md): MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2021-45845](https://cve.now/CVE-2021-45845.md): The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbitrary commands via a (no CVSS)
- [CVE-2021-45844](https://cve.now/CVE-2021-45844.md): Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filen (no CVSS)
- [CVE-2021-45340](https://cve.now/CVE-2021-45340.md): In Libsixel prior to and including v1.10.3, a NULL pointer dereference in the stb\_image.h component of libsixel allows attackers to cause a (no CVSS)
- [CVE-2022-0268](https://cve.now/CVE-2022-0268.md): Cross-site Scripting (XSS) - Stored in getgrav/grav (CVSS 5.7, getgrav/grav)
- [CVE-2022-0338](https://cve.now/CVE-2022-0338.md): Insertion of Sensitive Information into Log File in delgan/loguru (CVSS 4.3, delgan/loguru · loguru)
- [CVE-2022-23935](https://cve.now/CVE-2022-23935.md): lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\\|$/ check, leading to command injection. (no CVSS)
- [CVE-2021-46483](https://cve.now/CVE-2021-46483.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c. (no CVSS)
- [CVE-2021-46481](https://cve.now/CVE-2021-46481.md): Jsish v3.5.0 was discovered to contain a memory leak via linenoise at src/linenoise.c. (no CVSS)
- [CVE-2021-46482](https://cve.now/CVE-2021-46482.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c. (no CVSS)
- [CVE-2021-46480](https://cve.now/CVE-2021-46480.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiValueObjDelete in src/jsiEval.c. (no CVSS)
- [CVE-2021-46478](https://cve.now/CVE-2021-46478.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiClearStack in src/jsiEval.c. (no CVSS)
- [CVE-2021-46475](https://cve.now/CVE-2021-46475.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsi\_ArraySliceCmd in src/jsiArray.c. (no CVSS)
- [CVE-2021-46477](https://cve.now/CVE-2021-46477.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via RegExp\_constructor in src/jsiRegexp.c. (no CVSS)
- [CVE-2021-46474](https://cve.now/CVE-2021-46474.md): Jsish v3.5.0 was discovered to contain a heap buffer overflow via jsiEvalCodeSub in src/jsiEval.c. (no CVSS)
- [CVE-2021-44994](https://cve.now/CVE-2021-44994.md): There is an Assertion ''JERRY\_CONTEXT (jmem\_heap\_allocated\_size) == 0'' failed at /jerry-core/jmem/jmem-heap.c in Jerryscript 3.0.0. (no CVSS)
- [CVE-2021-44993](https://cve.now/CVE-2021-44993.md): There is an Assertion ''ecma\_is\_value\_boolean (base\_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0 (no CVSS)
- [CVE-2021-44992](https://cve.now/CVE-2021-44992.md): There is an Assertion ''ecma\_object\_is\_typedarray (obj\_p)'' failed at /jerry-core/ecma/operations/ecma-typedarray-object.c in Jerryscript 3. (no CVSS)
- [CVE-2021-44988](https://cve.now/CVE-2021-44988.md): Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma\_find\_named\_property in ecma-helpers.c. (no CVSS)
- [CVE-2021-40158](https://cve.now/CVE-2021-40158.md): A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond allocated boundaries (no CVSS, Inventor)
- [CVE-2021-40159](https://cve.now/CVE-2021-40159.md): An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with other vulnerabilities m (no CVSS, Inventor)
- [CVE-2021-45341](https://cve.now/CVE-2021-45341.md): A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Co (no CVSS)
- [CVE-2021-45342](https://cve.now/CVE-2021-45342.md): A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Co (no CVSS)
- [CVE-2021-45343](https://cve.now/CVE-2021-45343.md): In LibreCAD 2.2.0, a NULL pointer dereference in the HATCH handling of libdxfrw allows an attacker to crash the application using a crafted (no CVSS)
- [CVE-2022-0351](https://cve.now/CVE-2022-0351.md): Access of Memory Location Before Start of Buffer in vim/vim (CVSS 8.4, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.